coiinbase-logiin[.]blogspot[.]de

The domain coiinbase-logiin.blogspot.de was registered on February 21, 2026 through Google LLC and is hosted on Google’s infrastructure, as indicated by the four Google nameservers (ns1.google.com through ns4.google.com) and the resolved IP address 172.217.20.129, which belongs to AS15169 Google LLC and resolves to a United States location. The site presents an HTTP 302 response and serves a TLS certificate issued by Google Trust Services under the WE2 intermediate, confirming the use of legitimate Google SSL infrastructure. The page title "How do I buy Bitcoin on Coinbase?" and the explicit brand target of Coinbase identify the campaign as a crypto‑related brand impersonation. Detection telemetry shows the domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL.

Google Safe Browsing classifies the site as a social engineering threat, and VirusTotal reports nine of ninety‑five scanning engines flagging the domain, reinforcing the malicious assessment. The Gridinsoft trust score of 0 out of 100 further indicates a high confidence of abuse. Technical fingerprints reveal the presence of Blogger, Java, Python, OpenGSE, and HTTP/3 components, consistent with a typical compromised or malicious blog platform. The risk rating is high and the campaign remains active as of the report date, July 25, 2026.

Uncertainty remains regarding the exact phishing payload or credential‑capture mechanisms, as no visual or form analysis is available. Defenders should block the domain at network perimeters, update URL filtering and safe browsing lists, and monitor for similar subdomains leveraging Google’s Blogger service to impersonate financial brands. Continuous re‑scanning of the domain and correlation with emerging threat intel are recommended to detect any evolution of the campaign.